6th Internet, Law and Politics Conference (III). Key Legal Aspects for Putting your Business in the Cloud

Notes from the 6th Internet, Law and Politics Conference: Cloud Computing: Law and Politics in the Cloud, organized by the Open University of Catalonia, School of Law and Political Science, and held in Barcelona, Spain, on July 7th and 8th, 2010. More notes on this event: idp2010.

Round Table: Key Legal Aspects for Putting your Business in the Cloud
Chairs: Miquel Peguera

Controlling the provider
Xavier Ribas, Landwell Global.

If you cannot see the video please visit <a href="http://ictlogy.net/post.php?p=3408">http://ictlogy.net/post.php?p=3408</a>

Increasing trend to outsource services at the enterprise, including some belonging to the core business. With cloud computing, even risk management is shared with or outsourced to a third party.

But, are you then losing control and even putting your firm in the hands of your providers? You lose control of the confidence chain, control of data, of the quality of service, of the available preventive measures, of reputation risk management (and there actually is an increase of risk of reputation loss), control of secondary and non-consented outsourcing, international data transfer, etc.

How to solve this? How to regain control over these issues? Possible clauses:

  • Confidentiality, security obligations, quality standards.
  • Auditing, provider controls.
  • Liability, insurances.

An obligations map should be drawn and agreed upon, including what happens once the relationship ends (e.g. what will happen to data in a blog once the service is discontinued?).

Manel Martínez Ribas, ID-LawPartners.

If you cannot see the video please visit <a href="http://ictlogy.net/post.php?p=3408">http://ictlogy.net/post.php?p=3408</a>

What is the difference amongst open source and open cloud? Is there any open source cloud?

The four freedoms of free software, do they still apply in cloud applications or services? More indeed: free software developers using cloud services, will they find their free code closed? This gives birth to new licenses where cloud service providers are able to use specific software, let it to the end user as software as a service (SaaS)… thus allowing for copyleft on one end and a sort of closeness on the other end.

Open cloud computing allows, as it happens with free software, to make modifications.

Fabrizio Capobianco: reasons to care about open cloud computing in the mobile arena:

  • It is already a big issue.
  • It is a necessity.
  • It should be interoperable
  • It normally depends of closed devices.

The Open Cloud Manifesto pretends to settle the debate and reach some agreement (equilibrium?) on how to respect the free software freedoms in cloud computing.


  • Avoid lock in.
  • Use standards.
  • Go on with initiatives according to the needs of the customer.
  • Teamwork and network.

It seems that cloud computing will be the main entry point for institutions to (at last) use free software massively. Same with software providers, that will shift from proprietary software to free software.

Legal aspects to take your enterprise to the cloud
Ramon Miralles, Coordinator of Information Security and Auditing, Catalan Data Protection Agency.

If you cannot see the video please visit <a href="http://ictlogy.net/post.php?p=3408">http://ictlogy.net/post.php?p=3408</a>

It really does not matter to read or not the terms of reference of cloud services: their providers will change them unilaterally and many without notice. So…

The problem is neither (only) that we do not know where our data are, but nor we know where our data pass through, because they constantly change paths.

A Cloud computing solution: self-service, broad access in the Net, full of resources, fast and easy, measurable and supervised. A solution which might be the end of corporate computing.

As said, one of the big problems is not only that data are elsewhere, but that they circulate across borders and jurisdictions. The European Directive, in this sense, looks more at what is happening, rather than trying to typify each and every procedure that takes place on the Internet. It nevertheless needs some updating as cloud computing has really challenged web usage as we knew it.

Information self-determination: the right to control one’s own data, to know who has our data, what is done with them, etc. Information self-determination is at stake with cloud computing.

IDC Enterprise Panel (august 2008) states the following challenges/issues of cloud computing: security, performance, availability, hard to integrate with in-house IT, not enough ability to customize, doubts about cost, bring-back in-house might be difficult, not enough major suppliers, etc.

Main challenges of Cloud Computing:

  • Decrease of control over information and services.
  • Data treatment and processing.
  • International movement of data.
  • Applicable law.


If you cannot see the video please visit <a href="http://ictlogy.net/post.php?p=3408">http://ictlogy.net/post.php?p=3408</a>

Q: The Catalan Government is to move its education community to Google Applications. How are citizen rights guaranteed? Miralles: The problem can “easily” be solved by signing a contract. The problem is usually not as much as in privacy, but in transparency and availability of information by the user, to recover their information, etc.

Ramon Miralles: it makes no sense the distinction whether it is a human or a machine who processes the information, as this only creates legal defencelessness and insecurity. Indeed, it is in the core of data processing that it is automatized. So, we have to look at the essence of the data processing process, at what will be the end use, rather than at the how.

Manel Martínez: we have to differentiate between consented usage (contextual adds after reading your e-mail, as you agreed to that by accepting the terms of reference) and non-consented usage of data. Ramon Miralles: right, but the problem comes when the conditions are change unilaterally and, even if you are made aware of this, you are locked in and have really hard times migrating your data in a service you’re having difficulties to leave.

Q: how do we measure the cost of loss of reputation because a third party service failed? Xavier Ribas: this is very difficult to measure. It might be not very difficult to measure the non-returning customers, but it is definitely difficult to know how many new/potential customers will not use our services/products for the very first time after a reputation crisis has been suffered.

Jordi Vilanova: should not the WTO coordinate cloud computing services (in a legal and economic sense)? Miralles: it is clear that the traditional instruments to regulate economic activities (national and international regulation, contracts, etc.) might not perfectly fit in such activities as cloud computing. So, yes, WTO or another platform might be used to update regulation and procedures to brand new activities.

See also

6th Internet, Law and Politics Conference (2010)